|
| 1 | +# SCANOSS GitHub Actions Code Scan: Monorepo Setup Guide |
| 2 | + |
| 3 | +## Introduction |
| 4 | + |
| 5 | +This guide explains how to configure SCANOSS code scanning for monorepos where you want to scan specific subdirectories independently. |
| 6 | + |
| 7 | +## Overview |
| 8 | + |
| 9 | +Instead of scanning the entire repository on every change, you can create separate workflows that: |
| 10 | +- Trigger only when specific paths are modified |
| 11 | +- Scan only the relevant subdirectory |
| 12 | +- Run independently with their own results |
| 13 | + |
| 14 | +## Architecture |
| 15 | + |
| 16 | +The setup uses a **reusable workflow** pattern: |
| 17 | +1. **Base workflow** (`scanoss.yml`) - The reusable workflow that performs the actual scanning |
| 18 | +2. **Trigger workflows** (e.g., `scanoss-component1.yml`, `scanoss-component2.yml`) - Individual workflows that call the base workflow with specific parameters |
| 19 | + |
| 20 | +## Setup Instructions |
| 21 | + |
| 22 | +### Step 1: Modify Your Existing scanoss.yml |
| 23 | + |
| 24 | +Add these sections to make it reusable: |
| 25 | + |
| 26 | + ```yaml |
| 27 | + on: |
| 28 | + workflow_call: |
| 29 | + inputs: |
| 30 | + FILTERED_PATH: |
| 31 | + description: 'Directory to scan' |
| 32 | + required: true |
| 33 | + type: string |
| 34 | + secrets: |
| 35 | + SC_API_KEY: |
| 36 | + required: false |
| 37 | + DT_API_KEY: |
| 38 | + required: false |
| 39 | +``` |
| 40 | +
|
| 41 | + Then update the scanPath parameter to use the input: |
| 42 | +
|
| 43 | +```yaml |
| 44 | + - name: Run SCANOSS Code Scan |
| 45 | + uses: scanoss/code-scan-action@v1.4.0 |
| 46 | + with: |
| 47 | + scanPath: ${{ inputs.FILTERED_PATH }} |
| 48 | + # ... other parameters |
| 49 | +``` |
| 50 | + |
| 51 | +### Step 2: Create Trigger Workflows |
| 52 | + |
| 53 | +Create separate workflow files for each component: |
| 54 | + |
| 55 | +`.github/workflows/scanoss-component1.yml`: |
| 56 | +```yaml |
| 57 | +name: SCANOSS - Component1 |
| 58 | + |
| 59 | +on: |
| 60 | + push: |
| 61 | + paths: |
| 62 | + - 'component1/**' <-- |
| 63 | + |
| 64 | + # OR |
| 65 | + |
| 66 | + pull_request: |
| 67 | + paths: |
| 68 | + - 'component1/**' <-- |
| 69 | + |
| 70 | +jobs: |
| 71 | + call-scanoss-workflow: |
| 72 | + uses: ./.github/workflows/scanoss.yml # Exact path to scanoss.yml inside your repo |
| 73 | + with: |
| 74 | + FILTERED_PATH: 'component1' <-- Remove /** and add here |
| 75 | + secrets: inherit |
| 76 | +``` |
| 77 | +
|
| 78 | +`.github/workflows/scanoss-component2.yml`: |
| 79 | +```yaml |
| 80 | +name: SCANOSS - Component2 |
| 81 | +
|
| 82 | +on: |
| 83 | + push: |
| 84 | + paths: |
| 85 | + - 'component2/**' <-- |
| 86 | +
|
| 87 | + # OR |
| 88 | +
|
| 89 | + pull_request: |
| 90 | + paths: |
| 91 | + - 'component2/**' <-- |
| 92 | +
|
| 93 | +jobs: |
| 94 | + call-scanoss-workflow: |
| 95 | + uses: ./.github/workflows/scanoss.yml # Exact path to scanoss.yml inside your repo |
| 96 | + with: |
| 97 | + FILTERED_PATH: 'component2' <-- Remove /** and add here |
| 98 | + secrets: inherit |
| 99 | +``` |
| 100 | + |
| 101 | +## Example Structure |
| 102 | + |
| 103 | +my-monorepo/ |
| 104 | +├── .github/workflows/ |
| 105 | +│ ├── scanoss.yml # Reusable workflow |
| 106 | +│ ├── scanoss-component1.yml # Triggers on component1/** |
| 107 | +│ ├── scanoss-component2.yml # Triggers on component2/** |
| 108 | +│ └── scanoss-common.yml # Triggers on common/** |
| 109 | +├── component1/ |
| 110 | +├── component2/ |
| 111 | +└── common/ |
| 112 | + |
| 113 | +## Key Points |
| 114 | + |
| 115 | +- Path filters: Only trigger workflows when specific directories change |
| 116 | +- secrets: inherit: Required to pass repository secrets to the reusable workflow |
| 117 | +- Local workflow reference: for example ./.github/workflows/scanoss.yml (no branch name) |
| 118 | +- Secrets are optional: SC_API_KEY and DT_API_KEY (dt required if Dependency Track is enabled) |
| 119 | + |
| 120 | +## Benefits |
| 121 | + |
| 122 | +- Faster CI/CD - only scan affected components |
| 123 | +- Clearer results - each component has its own scan |
| 124 | +- Parallel execution - multiple components scan simultaneously |
| 125 | +- Reduced noise - PRs only show results for changed components |
0 commit comments